npm

package
v0.3.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 12, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ExtractPackageName 

func ExtractPackageName(path string) string

ExtractPackageName extracts the package name from a node_modules path. e.g., "node_modules/@scope/package" -> "@scope/package" e.g., "node_modules/package" -> "package" e.g., "node_modules/a/node_modules/b" -> "b"

func ParseIntegrity 

func ParseIntegrity(integrity string) (algorithm string, hash []byte, err error)

ParseIntegrity parses an SRI integrity string and returns the algorithm and hash. e.g., "sha512-abc123..." -> ("sha512", []byte{...})

Types

type Decomposer 

type Decomposer struct{}

func New 

func New() *Decomposer

func (*Decomposer) DefaultOptions 

func (d *Decomposer) DefaultOptions() any

DefaultOptions returns the default options for the npm decomposer.

func (*Decomposer) Extract 

func (d *Decomposer) Extract(opts *api.DecomposerOptions) (*sbom.NodeList, error)

Extract parses package.json and package-lock.json files and builds the complete dependency graph as a protobom NodeList.

func (*Decomposer) FindCodeBases 

func (d *Decomposer) FindCodeBases(index *code.PathIndex) ([]string, error)

FindCodeBases locates npm codebases by looking for package-lock.json files.

func (*Decomposer) Requirements 

func (d *Decomposer) Requirements(_ *api.DecomposerOptions) []api.Requirement

Requirements returns the requirements for the decomposer. No external binary required - uses pure Go implementation.

type DependencyTree 

type DependencyTree struct {
	// contains filtered or unexported fields
}

DependencyTree builds a complete dependency graph from npm package files.

func NewDependencyTree 

func NewDependencyTree(pkg *PackageJSON, lock *PackageLock) *DependencyTree

NewDependencyTree creates a new dependency tree from parsed npm package files.

func (*DependencyTree) Build 

func (dt *DependencyTree) Build(opts *api.DecomposerOptions) (*sbom.NodeList, error)

Build constructs the complete dependency graph as a protobom NodeList.

func (*DependencyTree) GetDependencyCount 

func (dt *DependencyTree) GetDependencyCount() int

GetDependencyCount returns the total number of dependencies.

func (*DependencyTree) GetDirectDependencyCount 

func (dt *DependencyTree) GetDirectDependencyCount() int

GetDirectDependencyCount returns the number of direct dependencies.

func (*DependencyTree) ListDependencies 

func (dt *DependencyTree) ListDependencies() []string

ListDependencies returns a sorted list of all dependencies for debugging/testing.

type DependencyType 

type DependencyType int

DependencyType represents the type of dependency relationship. 

const (
	DepTypeNormal DependencyType = iota
	DepTypeDev
	DepTypePeer
	DepTypeOptional
)

func (DependencyType) String 

func (dt DependencyType) String() string

String returns a string representation of the dependency type.

type LockPackage 

type LockPackage struct {
	Name                 string            `json:"name,omitempty"`
	Version              string            `json:"version"`
	Resolved             string            `json:"resolved,omitempty"`
	Integrity            string            `json:"integrity,omitempty"`
	License              string            `json:"license,omitempty"`
	Dev                  bool              `json:"dev,omitempty"`
	Optional             bool              `json:"optional,omitempty"`
	Peer                 bool              `json:"peer,omitempty"`
	DevOptional          bool              `json:"devOptional,omitempty"`
	Dependencies         map[string]string `json:"dependencies,omitempty"`
	OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
	// contains filtered or unexported fields
}

LockPackage represents a package entry in package-lock.json.

type Options 

type Options struct {
	// IncludeDevDependencies includes dev dependencies in the output.
	IncludeDevDependencies bool

	// IncludeOptionalDependencies includes optional dependencies in the output.
	IncludeOptionalDependencies bool

	// IncludePeerDependencies includes peer dependencies in the output.
	IncludePeerDependencies bool

	// IgnoreNodeModulesCodebases instructs the decomposer to ignore any codebases
	// in node_modules directories (package-lock files from pulled dependencies)
	IgnoreNodeModulesCodebases bool
}

Options configures the npm dependency extraction.

type PackageJSON 

type PackageJSON struct {
	Name                 string            `json:"name"`
	Version              string            `json:"version"`
	Description          string            `json:"description,omitempty"`
	License              string            `json:"license,omitempty"`
	Homepage             string            `json:"homepage,omitempty"`
	Repository           *Repository       `json:"repository,omitempty"`
	Dependencies         map[string]string `json:"dependencies,omitempty"`
	DevDependencies      map[string]string `json:"devDependencies,omitempty"`
	PeerDependencies     map[string]string `json:"peerDependencies,omitempty"`
	OptionalDependencies map[string]string `json:"optionalDependencies,omitempty"`
}

PackageJSON represents the structure of a package.json file.

func ParsePackageJSON 

func ParsePackageJSON(dir string) (*PackageJSON, error)

ParsePackageJSON parses a package.json file from the given directory.

func ParsePackageJSONData 

func ParsePackageJSONData(data []byte) (*PackageJSON, error)

ParsePackageJSONData parses package.json content from bytes.

func (*PackageJSON) GetAllDependencyNames 

func (pj *PackageJSON) GetAllDependencyNames() []string

GetAllDependencyNames returns all direct dependency names.

func (*PackageJSON) GetDirectDependencies 

func (pj *PackageJSON) GetDirectDependencies() map[string]DependencyType

GetDirectDependencies returns a map of dependency names to their types.

type PackageKey 

type PackageKey struct {
	Name    string
	Version string
}

PackageKey uniquely identifies a package by name and version.

func (PackageKey) String 

func (pk PackageKey) String() string

type PackageLock 

type PackageLock struct {
	Name            string                 `json:"name"`
	Version         string                 `json:"version"`
	LockfileVersion int                    `json:"lockfileVersion"`
	Requires        bool                   `json:"requires"`
	Packages        map[string]LockPackage `json:"packages"`
}

PackageLock represents the structure of a package-lock.json file (v3 format).

func ParsePackageLock 

func ParsePackageLock(dir string) (*PackageLock, error)

ParsePackageLock parses a package-lock.json file from the given directory.

func ParsePackageLockData 

func ParsePackageLockData(data []byte) (*PackageLock, error)

ParsePackageLockData parses package-lock.json content from bytes.

func (*PackageLock) BuildPackageIndex 

func (pl *PackageLock) BuildPackageIndex() (byKey map[PackageKey]*LockPackage, byName map[string][]*LockPackage, byPath map[string]*LockPackage)

BuildPackageIndex creates indexes for quick package lookups.

func (*PackageLock) GetRootPackage 

func (pl *PackageLock) GetRootPackage() *LockPackage

GetRootPackage returns the root package (the one at key "").

type Repository 

type Repository struct {
	Type string `json:"type"`
	URL  string `json:"url"`
}

Repository represents the repository field in package.json.

func (*Repository) UnmarshalJSON 

func (r *Repository) UnmarshalJSON(data []byte) error

UnmarshalJSON handles both string and object forms of repository.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.